The layer everyone forgets to check
A small business can have MFA everywhere, a properly hardened Microsoft 365 tenant, and tested immutable backups - and still lose control of its email and website in an afternoon, because nobody ever looked at who controls its DNS. DNS sits underneath everything else: it's not an app or an account most people think about, it's the layer that decides where every email and every website visit actually goes. That makes it one of the cheapest places for an attacker to cause maximum damage, and one of the least-checked.
What DNS actually is, in plain terms
DNS is the phone book that turns a domain name into the servers that actually run it. There are two different jobs bundled into that one idea, and the distinction matters:
- Recursive DNS is the lookup your laptop or phone does every time it visits a website - asking "where does this domain point?" and getting an answer back.
- Authoritative DNS is the source of that answer: the actual record of where your domain's email and website live, held by your domain registrar or a DNS hosting provider.
Most small businesses never separate these two ideas, because for years the same company - the registrar - quietly did both. That's usually fine. What matters is that authoritative DNS is the record that's actually worth protecting, because it's the one an attacker can change.
How a domain actually gets hijacked
Domain hijacking is rarely a cryptographic attack. It's almost always an account takeover: whoever controls the login to your registrar or DNS host controls where your domain points, full stop. If that account has a reused password and no MFA - which describes a lot of registrar accounts, because businesses lock down their email and their M365 tenant and never think about the account that controls DNS - it's one of the easiest accounts in the business to compromise, and one of the most damaging once it is.
Credential theft at scale is exactly the kind of attack that gets a registrar account into the wrong hands in the first place: Microsoft's 2025 threat research describes infostealer malware harvesting credentials and authentication tokens at scale as a primary way attackers gain footholds[1], and Mandiant's 2026 incident-response data still counts some form of prior compromise or credential-based access among the leading ways attackers get in, rising to 30% of engagements for ransomware operations specifically[2]. A registrar account with a reused password sitting in nobody's password manager is exactly the kind of target that pattern describes.
What it's worth once someone has it
Once an attacker controls your DNS, they control your MX records - which means every email your domain is supposed to receive, including password resets, invoices, and anything a client sends you, can be silently redirected. Microsoft's own guidance on email security is blunt about the underlying risk: email spoofing and domain impersonation involve forging the sender address or mimicking a trusted domain to make an email appear legitimate[3] - and a hijacked DNS record doesn't even need to forge anything. It's not impersonating your domain. It is your domain.
This is a different, and cheaper, attack than the more familiar lookalike-domain phishing - registering a near-miss domain, like micros0ft.com instead of microsoft.com, to trick one person into clicking[4]. A lookalike domain has to fool a human. A hijacked DNS record fools the infrastructure itself, and every system and person that trusts it.
Cache poisoning: the quieter version
There's a second, subtler way DNS gets attacked that doesn't require compromising anyone's account at all: cache poisoning. A recursive resolver - the one doing lookups on behalf of users - can be tricked into caching a false answer for a domain, redirecting traffic without ever touching the real authoritative records. The domain's actual DNS is untouched; the forged answer just sits cached somewhere in the resolution path until it expires.
DNSSEC exists specifically to close this gap. It cryptographically signs DNS responses, so a resolver can verify that an answer genuinely came from the domain's authoritative source rather than being forged along the way. It's a real, useful defence - and it's also a different defence to the one that matters for account takeover. DNSSEC does nothing to stop someone who has legitimately logged into your registrar account, because a valid login can just sign the zone correctly with the fraudulent records. The two problems need two different answers, and most small businesses that have heard of DNSSEC assume it covers both.
What a hardened authoritative DNS platform does differently
The DNS most small businesses run is whatever came free with their registrar - general-purpose infrastructure, shared with millions of other domains, with no particular hardening against DDoS or the volume of query traffic a real attack generates. The authoritative DNS platform we run client domains on, Secure64 LineGuard, is built specifically to be attack-resistant rather than merely functional: it runs on a hardened operating system built for DNS rather than a general-purpose one, and it's distributed across an anycast network, so a flood of traffic aimed at taking one location offline doesn't take the domain's DNS down with it. None of that replaces good account hygiene - it's the layer underneath it, so that even a well-resourced attack against the DNS infrastructure itself doesn't succeed where account-level defences would have.
The minimum viable DNS hygiene checklist
Most of this is a half-day project, not a project plan:
- Find out who actually controls the registrar account - not the M365 tenant, the actual domain registrar login. If nobody can answer this without checking, that's the first finding.
- Put it in the password manager and turn on MFA, the same as any other account with this much reach. Registrar accounts are routinely the one login in a business that skipped this step.
- Lock down transfer and contact changes - most registrars offer a transfer lock and a requirement that ownership or DNS changes get a confirmation email or additional verification. Turn it on.
- Enable DNSSEC if the registrar or DNS host supports it - it closes the cache-poisoning path even though it doesn't touch account-takeover risk.
- Monitor DNS records for unexpected changes. A monitored, alerted DNS zone means an unauthorised change gets caught in minutes, not discovered when clients start saying their emails are bouncing.
None of these require migrating platforms or rebuilding anything. They require someone to actually check who holds the keys to a system most businesses have never once logged into since the domain was registered.